{
  "title": "Package version inventory",
  "description": "Monitor known OSV advisories for explicit package versions. Compare affected ranges, fix events and source corrections, with bounded checks of previously saved IDs for explicit withdrawals.",
  "type": "object",
  "schemaVersion": 1,
  "properties": {
    "packages": {
      "title": "Package version inventory",
      "type": "array",
      "editor": "json",
      "description": "Up to 20 objects containing ecosystem, name and one explicit version. Supported ecosystems: npm, PyPI, Maven, Go, crates.io and RubyGems. Omitted or empty uses lodash 4.17.20 as a historical sample. No credentials, repository cloning or version-range inputs.",
      "default": [],
      "prefill": [
        {
          "ecosystem": "npm",
          "name": "lodash",
          "version": "4.17.20"
        }
      ],
      "sectionCaption": "1 - Your explicit inventory",
      "sectionDescription": "Read public source evidence for a small, exact watchlist."
    },
    "maxResults": {
      "title": "Maximum saved observations",
      "type": "integer",
      "default": 5,
      "minimum": 1,
      "maximum": 1000,
      "description": "Caps confirmed dataset rows, including saved unchanged observations. A limit is a sample, not a complete inventory; inspect sourceCoverage and sourcesNotReached in SUMMARY.",
      "sectionCaption": "2 - Output and comparisons"
    },
    "comparePrevious": {
      "title": "Compare against saved observations",
      "type": "boolean",
      "default": false,
      "description": "First observations are new. Later rows include changed/unchanged status, prior saved values and changedFields. Only confirmed saved rows advance history."
    },
    "onlyChanges": {
      "title": "Save only new or changed source observations",
      "type": "boolean",
      "default": false,
      "description": "Implies comparison. A healthy unchanged or no-match run can save zero rows. Missing advisory IDs never imply remediation."
    },
    "snapshotName": {
      "title": "Comparison namespace",
      "type": "string",
      "editor": "textfield",
      "default": "default",
      "description": "1-80 letters, numbers, underscores or hyphens. History also includes the exact sorted inventory. Use one writer per scope; changing the inventory starts a separate baseline."
    },
    "stateStoreName": {
      "title": "Named history store",
      "type": "string",
      "editor": "textfield",
      "default": "maydit-osv-package-watchlists",
      "description": "3-63 letters, numbers or hyphens. Accessed only for comparisons. Use a dedicated store for each customer workflow."
    },
    "maxAdvisoriesPerPackage": {
      "title": "Maximum current advisories per package",
      "type": "integer",
      "default": 20,
      "minimum": 1,
      "maximum": 100,
      "description": "Selects current query matches in advisory-ID order. A smaller bound explicitly reports partial source coverage. Previously saved absent IDs are checked separately, up to 100 per package.",
      "sectionCaption": "3 - Source and run bounds"
    },
    "maxPagesPerPackage": {
      "title": "Maximum query pages per package",
      "type": "integer",
      "default": 3,
      "minimum": 1,
      "maximum": 10,
      "description": "Continue publisher pagination, including token-only pages, until complete or this bound. Repeated tokens and malformed responses fail explicitly."
    },
    "maxRunSeconds": {
      "title": "Run budget in seconds",
      "type": "integer",
      "default": 240,
      "minimum": 30,
      "maximum": 900,
      "description": "Includes source and comparison work; also bounded by the platform deadline minus 25 seconds. Each response is capped to 2 MiB. Access and rate refusals are reported."
    }
  }
}